Privacy policy

Last updated: 7 September 2026.

This policy explains how 2FRT, which operates The Baby Blog and its baby-list service ("we", "us"), handles personal data on the public website and in the app. For privacy questions, use the website contact form or email contact@2frt.com.

What data do we handle?

• Account data: your name, email address, profile photo, account identifier and sign-in method when you use Google or an email sign-in link.
• Baby-list data: country, title, message, expected birth date, stated preferences, delivery address, products, quantities, links, comments and review decisions.
• Uploaded files: cover image, invitation and images for custom products or models.
• Guest activity: name, email address, message to the family, reserved or purchased products and chosen quantities.
• Contact and support: name, email address, subject and message submitted through the contact form.
• Technical and usage data: IP address, browser, device, security and service logs, and aggregated visits to the public website.

Where does the data come from?

We receive data directly from you, from Google when you choose that sign-in method, from a list owner when they create and share a list, from guests when they interact with one, and from our technical providers as they operate the service.

Why do we use it, and on what basis?

We use data to create and secure accounts; create, edit, share and close lists; display products and files; record guest choices; send access links; respond to messages; prevent abuse; maintain, diagnose and improve the service; and meet legal obligations. Depending on the activity, we rely on performing the service you request, our legitimate interests in security and product improvement, compliance with legal duties, or consent where we specifically ask for it.

Automated link analysis only extracts and organises product information. It does not make decisions about you that have legal or similarly significant effects.

Sharing and access to a list

When the owner creates a private link, anyone who receives it can view the shared version of the list, including its cover, invitation and delivery address if these have been added. Guests can also record choices without creating an account. Owners should share the link only with people they trust.

We use providers that process data to deliver the service, including Google/Firebase for authentication, database, functions and storage; Resend to deliver sign-in emails; Vercel for hosting and public-site metrics; OpenAI only to analyse product links submitted to that feature; and Twilio SendGrid to deliver contact-form messages. We may also disclose data where required by law or needed to protect rights and safety. We do not sell personal data.

International transfers

Some providers may process data outside the UK. Where they do, we use safeguards recognised by applicable data-protection law, such as adequacy regulations or appropriate contractual protections.

How long do we keep data?

We keep account and private-list data while needed to provide the service or until the list is deleted, unless law requires longer retention. Guest access ends when the list is closed manually or after the 3, 6, 9 or 12-month period selected on first sharing. The shared copy and its files then stop being available; the owner's private version remains until they delete the list. Deleting a list also deletes its associated uploaded files. Technical logs and support messages are kept only as long as needed for security, support and legal duties.

Your rights

You may ask for access, correction, erasure, portability, restriction or objection, withdraw consent where consent is the basis, and ask not to be subject to solely automated decisions with legal or similarly significant effects. Email contact@2frt.com; we may verify your identity before responding. You may also complain to the Information Commissioner's Office (ICO).

Security, choices and children

We use access controls and technical safeguards, although no online service removes every risk. You can leave optional fields blank and close or delete a list. The service is intended for adults organising baby lists; we do not seek to collect data directly from children. Please avoid uploading unnecessary health information, documents or images of children.

Changes to this policy

We may update this policy when the service or applicable rules change. The date above identifies the latest version.